CVE-2019-7325

Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as multiple views under...

6.1 MediumFix available

Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as multiple views under web/skins/classic/views insecurely utilize $_REQUEST['PHP_SELF'], without applying any proper filtration.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.90%Up 0.5 points since Apr 14, 2021

What each source reports

NVD Score used 6.1

Record: CVE-2019-7325
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-7325
Updated: 2026-11-02

EUVDEUVD-2019-16868 No score

Record: EUVD-2019-16868
Updated: 2026-11-03

GitHub AdvisoriesGHSA-f27v-qrrf-f3pw 6.1

Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as multiple views under...

Record: GHSA-f27v-qrrf-f3pw
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVALPINE-CVE-2019-7325 6.1

Record: ALPINE-CVE-2019-7325
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-03

OSV 6.1

Record: CVE-2019-7325
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-7325 6.1

Record: DEBIAN-CVE-2019-7325
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-7325 6.1

Record: UBUNTU-CVE-2019-7325
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVUSN-5889-1 No score

zoneminder vulnerabilities

It was discovered that ZoneMinder was not properly sanitizing URL parameters for certain views. An attacker could possibly use this issue to perform a cross-site scripting (XSS) attack. This issue was only fixed in Ubuntu 16.04 ESM. (CVE-2019-6777)

It was discovered that ZoneMinder was not properly sanitizing stored user input later printed to the user in certain views. An attacker could possibly use this issue to perform a cross-site scripting (XSS) attack. This issue was only fixed in Ubuntu 16.04 ESM. (CVE-2019-6990, CVE-2019-6992)

It was discovered that ZoneMinder was not properly limiting data size and not properly performing bound checks when processing username and password data, which could lead to a stack buffer overflow. An attacker could possibly use this issue to bypass authentication, cause a denial of service or execute arbitrary code. This issue was only fixed in Ubuntu 16.04 ESM. (CVE-2019-6991)

It was discovered that ZoneMinder was not properly defining and filtering data that was appended to the webroot URL of a view. An attacker could possibly use this issue to perform cross-site scripting (XSS) attacks. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 20.04 ESM. (CVE-2019-7325, CVE-2019-7329)

It was discovered that ZoneMinder was not properly sanitizing user input in the monitor editing view. An attacker could possibly use this issue to perform a cross-site scripting (XSS) attack. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 20.04 ESM. (CVE-2019-7331)

It was discovered that ZoneMinder was not properly sanitizing data related to file paths in a system. An attacker could possibly use this issue to execute arbitrary code. (CVE-2022-29806)

Record: USN-5889-1
Updated: 2026-11-02

Affected products

zoneminder

Affected packages

Affected packages
Package	Affected	Fixed
`zoneminder` Alpine:v3.15	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.16	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.17	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.18	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.19	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.20	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.21	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.22	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.23	before 1.36.7-r0	1.36.7-r0
`zoneminder` Alpine:v3.24	before 1.36.7-r0	1.36.7-r0

Show 6 moreShow less

Affected packages
Package	Affected	Fixed
`zoneminder` Debian:12	before 1.34.6-1	1.34.6-1
`zoneminder` Debian:13	before 1.34.6-1	1.34.6-1
`zoneminder` Debian:14	before 1.34.6-1	1.34.6-1
`zoneminder` Ubuntu:Pro:16.04:LTS	before 1.29.0+dfsg-1ubuntu2+esm1, plus listed versions 1.28.1-81.29.0+dfsg-11.29.0+dfsg-1ubuntu11.29.0+dfsg-1ubuntu2	1.29.0+dfsg-1ubuntu2+esm1
`zoneminder` Ubuntu:Pro:20.04:LTS	before 1.32.3-2ubuntu2+esm1, plus listed versions 1.32.3-2build11.32.3-2ubuntu11.32.3-2ubuntu2	1.32.3-2ubuntu2+esm1
`zoneminder` Ubuntu:Pro:22.04:LTS	before 1.36.12+dfsg1-1ubuntu0.1~esm1, plus listed versions 1.36.7+dfsg1-11.36.10+dfsg1-11.36.11+dfsg1-11.36.12+dfsg1-1	1.36.12+dfsg1-1ubuntu0.1~esm1

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-7325 is a medium vulnerability (CVSS 6.1) in Zoneminder, published February 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 59th percentile. Fixed in zoneminder 1.36.7-r0.

References

Show 14 moreShow less